security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Rule Tuning] (#2537)

Browse Source 
add t1018 Remote system discovery
This commit is contained in:
Isai
2023-02-15 14:58:29 -05:00
committed by GitHub
parent 73d581500c
commit f04ebf277c
2 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/discovery_enumerating_domain_trusts_via_dsquery.toml
+5 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2023/01/27"
updated_date = "2023/02/09"
[rule]
author = ["Elastic"]
@@ -49,7 +49,10 @@ framework = "MITRE ATT&CK"
id = "T1482"
name = "Domain Trust Discovery"
reference = "https://attack.mitre.org/techniques/T1482/"
[[rule.threat.technique]]
id = "T1018"
name = "Remote System Discovery"
reference = "https://attack.mitre.org/techniques/T1018/"
[rule.threat.tactic]
id = "TA0007"
rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml
+5 -2
View File
@@ -4,7 +4,7 @@ integration = ["endpoint", "windows"]
maturity = "production"
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
min_stack_version = "8.3.0"
updated_date = "2022/12/14"
updated_date = "2023/02/09"
[rule]
author = ["Elastic"]
@@ -54,7 +54,10 @@ framework = "MITRE ATT&CK"
id = "T1482"
name = "Domain Trust Discovery"
reference = "https://attack.mitre.org/techniques/T1482/"
[[rule.threat.technique]]
id = "T1018"
name = "Remote System Discovery"
reference = "https://attack.mitre.org/techniques/T1018/"
[rule.threat.tactic]
id = "TA0007"